DatabricksSecretsProvider

Databricks Secrets provider.

class scamander.secrets.databricks.DatabricksSecretsProvider(default_scope: str | None = None)

Basisklassen: SecretProvider

Retrieve secrets from the Databricks secret store via dbutils.

Notitie

The Databricks REST API does not expose secret values — they are only readable from within a Databricks notebook or job via dbutils.secrets.get(). This provider therefore only works when running inside the Databricks runtime.

dbutils is discovered automatically from the active SparkSession (job clusters / newer runtimes) or from the IPython user namespace (interactive notebooks).

Parameters:

default_scope – Default secret scope used when vault is not passed to get_secret().

Example:

provider = DatabricksSecretsProvider(default_scope="pipeline-secrets")
password = provider.get_secret("pg-password")

# Use a different scope per-call:
token = provider.get_secret("api-token", vault="other-scope")
get_secret(secret_name: str, vault: str | None = None) → str

Retrieve a secret from the Databricks secret store.

Parameters:

  • secret_name – The key name of the secret within the scope.

  • vault – Databricks secret scope name. Overrides default_scope set in the constructor.

Returns:

The secret value as a plain string.

Veroorzaakt:

  • ValueError – When no scope is available from the call or the constructor.

  • RuntimeError – When dbutils cannot be located, meaning this code is not running inside a Databricks runtime.